Certified Kubernetes Security Specialist: exam-style tasks on a real kubeadm cluster on your own Mac, built and graded by the GoldenKube CLI. Each card shows the domain, the cluster topology it needs, the recommended time and its points; the scenario page has the full task text. Scenarios run on Kubernetes 1.35, the version the CKS exam is based on (one minor version behind CKA and CKAD).
CKS is for "an accomplished Kubernetes practitioner (as evidenced by holding the CKA credential)": the Linux Foundation requires that you "must have taken and passed the Certified Kubernetes Administrator (CKA) exam prior to attempting the CKS exam", and the exam is based on Kubernetes v1.35, not the v1.37 of CKA and CKAD. The GoldenKube CKS scenarios therefore assume CKA skills and go to the places a security task touches: API server flags and static Pod manifests, the kubelet configuration on a worker, etcd encryption, AppArmor on the node, and audit logs.
They follow the six official domains: default-deny NetworkPolicies, blocking the metadata endpoint and kubelet CIS hardening (cluster setup); least-privilege RBAC, ServiceAccount tokens and API server authorization (cluster hardening); AppArmor and a node with a rogue service (system hardening); Pod Security Admission, Secrets encrypted at rest and as read-only volumes, and removing host namespaces (microservice vulnerabilities); permitted registries with a ValidatingAdmissionPolicy, static analysis, image digests and binary verification (supply chain); and audit policies, immutable containers and finding a crypto-miner (monitoring, logging and runtime security). Some of them need a second node, which the CLI provisions for that scenario.
| Questions | 15-20 performance-based tasks source |
|---|---|
| Duration (minutes) | 120 source |
| Passing score | 67% source |
| Price (USD) | 445 source |
| Validity (years) | 2 source |
| Delivery | Online, proctored, performance-based (command line) source |
| Prerequisites | Must have taken and passed the Certified Kubernetes Administrator (CKA) exam source |
| Retake policy | One retake per exam purchase if a passing score is not achieved source |
| Curriculum version | Based on Kubernetes v1.35 source |
Published scenarios per official CKS domain, next to the domain's exam weight (checked 2026-10-28 on the official page). 20 published scenarios today.
| Domain | Exam weight | Published scenarios |
|---|---|---|
| Cluster Setup | 15% | 3 |
| Cluster Hardening | 15% | 3 |
| System Hardening | 10% | 2 |
| Minimize Microservice Vulnerabilities | 20% | 4 |
| Supply Chain Security | 20% | 4 |
| Monitoring, Logging and Runtime Security | 20% | 4 |
goldenkube exam cks draws a curriculum-weighted set: 15 tasks in 120 minutes, pass at 67%. Solutions and hints are hidden in exam mode.
9 of 20 scenarios match · Clear filters
A CI ServiceAccount was given cluster-wide power; remove the bindings and grant a minimal namespaced Role instead.
Single node · ~8 min · 9 points
goldenkube start cks-hrd-001
Enforce the restricted Pod Security Standard on a namespace and bring a non-compliant Deployment into line without recreating it.
Single node · ~9 min · 9 points
goldenkube start cks-mic-001
Move a Secret from an environment variable to a read-only volume with restrictive file mode and make the Secret immutable.
Single node · ~8 min · 9 points
goldenkube start cks-mic-003
A tenant workload shares the node's network, PID and IPC namespaces, runs privileged and mounts the host; isolate it and enforce baseline.
Single node · ~8 min · 9 points
goldenkube start cks-mic-004
Run nginx with a read-only root filesystem, keeping only the directories it really needs writable through emptyDir volumes.
Single node · ~8 min · 7 points
goldenkube start cks-run-002
Investigate running containers to find the one executing a mining process, record it and contain it without destroying evidence.
Single node · ~7 min · 8 points
goldenkube start cks-run-003
Use an exported audit log to identify who deleted a Secret and from where, then revoke that user's namespace access.
Single node · ~8 min · 8 points
goldenkube start cks-run-004
Lock a namespace down with a default-deny ingress and egress policy, keep cluster DNS working and open exactly one client-to-server path.
Single node · ~9 min · 10 points
goldenkube start cks-set-001
Protect node metadata by blocking pod egress to 169.254.169.254 while keeping in-cluster traffic and other egress open.
Single node · ~6 min · 7 points
goldenkube start cks-set-002
goldenkube doctor.goldenkube login (free account).goldenkube submit; the result appears on your dashboard.Grading happens on your machine and is practice feedback, not an official score. Tasks are public; hints, reference solutions and grader internals are not.
Not yet. The CKS scenarios are published and readable here, but the first signed build of the CLI is not on the Homebrew tap, so the catalog is a preview. Running a scenario needs that release and a free account.
Because the official CKS page states that the exam is based on Kubernetes v1.35, while CKA and CKAD are based on v1.37. GoldenKube sets up CKS scenarios on Kubernetes 1.35 clusters so that flags and defaults match the exam version.
Not to use the labs. The CKA requirement applies to booking the CKS exam: the Linux Foundation requires a passed CKA first. The CKS tasks assume CKA-level cluster skills, so the CKA catalog is the natural place to start.